Program Slicing [Weiser'82]

• A program slice consists of the parts of a program that

Program Slicing
Michael L. Collard
(potentially) affect the values computed at some point
of interest, referred to as a slicing criterion
• Often a slicing criterion consists of a pair:
• (line-number, variable).

• program slicing is the task of computing program slices

• A program slice is often computed from the PDG

(Program Dependency Graph

Slice Types Slice Levels

• Backward static slice [Weiser]
• intraprocedural
• Executable slice
• Within a particular procedure (function/ method)
• Forward static slice
• interprocedural
• Dynamic slice
• Between procedures (functions/methods)
• Execution slice
Static Backward Slicing Static Backward
1. var n = read()
Criterion: <9, product>
2. var i = 1
• A backward slice of a program with respect to a 3. var sum = 0
program point p and set of program variables V 4. var product = 1
consists of all statements and predicates in the 5. while i <= n {
program that may affect the value of variables in V 6. sum = sum + i
at p 7. product = product * i
8. i = i + 1 }
• The program point p and the variables V together 9. println(sum)
form the slicing criterion, usually written <p, V> 10. println(product)

Static Backward Executable Slicing

1. var n = read()
Criterion: <9, product>
2. var i = 1
3. var sum = 0
• A slice is executable if the statements in the slice
4. var product = 1 form a syntactically correct program that can be
5. while i <= n { executed
6. sum = sum + i
7. product = product * i • If the slice is computed correctly (safely), the
8. i = i + 1 } results of running the program that is the
9. println(sum) executable slice produces the same result for
10. println(product) variables in V at p for all inputs
 Executable Slicing Executable Slicing
1. var n = read() 1. var n = read()
Criterion: <9, product> Criterion: <9, product>
2. var i = 1 2. var i = 1
3. var sum = 0 3. var sum = 0
4. var product = 1 4. var product = 1
5. while i <= n { 5. while i <= n {
6. sum = sum + i 6. sum = sum + i
7. product = product * i 7. product = product * i
8. i = i + 1 } 8. i = i + 1 }
9. println(sum) 9. println(sum)
10. println(product) 10. println(product)

Static Forward Slicing Static Forward

1. var n = read()
Criterion: <3, sum>
2. var i = 1
• A forward slice of a program with respect to a 3. var sum = 0
program point p and set of program variables V 4. var product = 1
consists of all statements and predicates in the 5. while i <= n {
program that may be affected by the value of 6. sum = sum + i
variables in V at p 7. product = product * i
8. i = i + 1 }
• The program point p and the variables V together 9. println(sum)
form the slicing criterion, usually written <p,V> 10. println(product)
 Static Forward Static Forward
1. var n = read() 1. var n = read()
Criterion: <3, sum> Criterion: <1, n>
2. var i = 1 2. var i = 1
3. var sum = 0 3. var sum = 0
4. var product = 1 4. var product = 1
5. while i <= n { 5. while i <= n {
6. sum = sum + i 6. sum = sum + i
7. product = product * i 7. product = product * i
8. i = i + 1 } 8. i = i + 1 }
9. println(sum) 9. println(sum)
10. println(product) 10. println(product)

Static Forward Dynamic Slicing

1. var n = read() • A dynamic slice of a program with respect to an input
Criterion: <1, n>
2. var i = 1 value of a variable v at a program point p for a
3. var sum = 0 particular execution e of the program is the set of all
4. var product = 1 statements in the program that affect the value of v at
5. while i <= n { p.
6. sum = sum + i
7. product = product * i • The program point p, the variables v, and the input i
8. i = i + 1 } for e form the slicing criterion, usually written <i, v, p>
9. println(sum)
10. println(product) • The slicing uses the execution history or trajectory for
the program with input i
 Dynamic Slicing Dynamic Slicing
1. var n = read() Input: n = 1, c2, c2 both true 1. var n = read() Input: n = 1, c2, c2 both true
2. for i in 1...n { 2. for i in 1...n {
3. var a = 2 Execution History: 1, 2, 3, 4, 3. var a = 2 Execution History: 1, 2, 3, 4,
4. if c1 { 5, 6, 9, 2, 10 4. if c1 { 5, 6, 9, 2, 10
5. if c2 { 5. if c2 {
6. a=4 Criterion: <1, 10, z) 6. a=4 Criterion: <1, 10, z)
7. } else { 7. } else {
8. a=6}} 8. a=6}}
9. z = a 9. z = a
10. println(z) } 10. println(z) }

Static Slicing Dynamic Slicing

1. var n = read() 1. var n = read() Input: n = 2, c2 true, c2 false
Criterion: <10, z>
2. for i in 1...n { 2. for i in 1...n { on 1st iteration, true on 2nd
3. var a = 2 3. var a = 2
4. if c1 { 4. if c1 { Execution History: 1, 2, 3, 4,
5. if c2 { 5. if c2 { 9, 2, 3, 4, 5, 6, 9, 2,10
6. a=4 6. a=4
7. } else { 7. } else { Criterion: <1, 10, z)
8. a=6}} 8. a=6}}
9. z = a 9. z = a
10. println(z) } 10. println(z) }
 Dynamic Slicing Execution Slicing
1. var n = read() Input: n = 2, c2 true, c2 false
2. for i in 1...n { on 1st iteration, true on 2nd
3. var a = 2
4. if c1 { Execution History: 1, 2, 3, 4,
5. if c2 { 9, 2, 3, 4, 5, 6, 9, 2,10 • An execution slice of a program with respect to an
6. a=4 input value of a variable v is the set of statements in
7. } else { Criterion: <1, 10, z)
the program that are executed with input v.
8. a=6}}
9. z = a
10. println(z) }

Execution Slicing Execution Slicing

Input: n = 1, c2, c2 both true
1. var n = read() Input: n = 1, c2, c2 both true 1. var n = read()
2. for i in 1...n { 2. for i in 1...n { Execution History: 1, 2, 3, 4,
3. var a = 2 3. var a = 2 5, 6, 9, 2, 10
Execution History: 1, 2, 3, 4,
4. if c1 { 5, 6, 9, 2, 10 4. if c1 {
5. if c2 { 5. if c2 { Execution Slice:
6. a=4 6. a=4 1, 2, 3, 4, 5, 6, 9, 10
7. } else { 7. } else {
8. a=6}} 8. a=6}}
9. z = a 9. z = a
10. println(z) } 10. println(z) }
 Creating Slices srcSlice
• Efficient, scalable, lightweight forward static slicing

• Alomari, H.W., Collard, M.L., Maletic, J. I., "A Very Efficient and Scalable
• Data sources: PDG, execution traces Forward Static Slicing Approach", in the Proceedings of the IEEE
International Working Conference on Reverse Engineering (WCRE'12),
Kingston, Ontario, Canada, October 15-18, 2012 pp. 425-434
• Challenges:
• Alomari, H.W., Collard, M.L., Maletic, J. I., Alhindawi, N., Meqdadi, O.,
"srcSlice: Very Efficient and Scalable Forward Static Slicing", Journal of
• interprocedural (approaches, but can be Software: Evolution and Process, DOI: 10.1002/smr.1651, Vol. 26, No. 11,
complicated) November 2014, pp. 931-961. (Special Issue on the Best Papers from
WCRE 2012)

• scalability • Not based on PDG, but computed directly from the source code

System Dictionary
• file, function, and variable names
1. main() {
• @index - an index of each variable in the order that it was 2. var sum = 0
declared in the function 3. var i = 1
4. while i <= 10 {
• slines - a list of lines that comprise the slice; 5. sum = sum + i
6. i = i + 1
• cfunctions - a list of functions called using the slicing variable
7. }
• dvariables - a list of variables that are data dependent on the 8. print(sum)
slice variable 9. print(i)
10.}
• pointers - a list of aliases of the slicing variable
 1. main() {
2. var sum = 0
3. var i = 1
4. while i <= 10 {
5. sum = sum + i
6. i = i + 1
7. }
8. print(sum)
9. print(i)
10.}